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I/We Claim: 



1. A method for controlling access, use and distribution of personal data of a user 
stored in a personal data repository, the method comprising the steps of: 

allowing a user to indicate which por tions of the personal data stored in the personal 
data repository are releasable to a second party; 

reaching an agreement, between the i ser and the second party, regarding use, by the 
second party, of any portions of the personal data in the personal data repository; and 

releasing any of the portions of the stored personal data in the personal data repository 
to the second party according to the agreemen :, wherein 

the agreement includes what items wit lin the personal data repository can be used by 
the second party, and 



only ones of the items which, accord 
party are released to the second party. 



; to the agreement, can be used by the second 



2. The method of claim 1, wherein tjie personal data about the user is collected 
automatically. 



3. The method of claim 1, wherein thd step of reaching the agreement comprises 
choosing an agreement provided by an independent agreement provider, wherein the 



independent agreement provider receives cor 
agreement. 



user. 



5. The method of claim 1, further compr 
about the user on a device operated by the user. 



lensation based on use of the provided 



4. The method of claim 1, wherein the personal data about the user is entered by the 



sing the step of storing the personal data 
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6. The method of claim 1, further 
about the user on a trusted party device. 

7. The method of claim 1, further 
about the user in a distributed manner among 
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omprising the step of storing the personal data 



comprising the step of storing the personal data 
a plurality of trusted party devices. 



8. The method of claim 1^ further comprising the step of allowing the user to perform 



at least one of adding, deleting or changing tr 



e personal data about the user. 



9. The method of claim 1, further ct unprising the step of defining a service profile 
within the personal data repository, whereiii the service profile includes portions of the 
personal data of the user and information regarding conditions under which items within the 
service profile can be used by the second part}. 

10. The method of claim 9, wherein the service profile includes information 
regarding a date and a time that any of the sto red information about the user was released to 
the second party and to whom the stored information was released.. 



11. The method of claim 9\ wherein the service profile includes information 
pertaining to a description of the agreement between the user and the second party. 

12. The method of claim 1, further comprising the step of acting, by a trusted party, 
as an agent of the user to negotiate use, by the second party, of any of the personal data of the 
user in return for compensation to the user for theluse of any of the personal data. 



13. The method of claim 1, further comprising the steps of recording a history of 
actions, by the user using a user device, as part of i he personal data of the user. 
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14. The method of claim 13, urther comprising defining, by the user, of a level of a 
type of the actions to be recorded. 

15. The method of claim 1, fu: ther comprising the steps of: 

receiving, at a trusted party device connected to a computer network, a first request 
from a device operated by a user; 

forming a second request frorr the first request, the second request being stripped of 
information that can associate the user with the second request; 

sending, from the trusted party (device, the second request over a computer network to 
a second party device; 1 

receiving, at the trusted party device, response information in response to the sending 
of the second request; \ 

forming a response based on the response information; and 

sending the response to the devici operated by the user. 

16. A method for selectively sending information, comprising the steps of: 
receiving, by a trusted party devia :, a request to send information; 

selecting a user device to receive t le information based on a willingness to receive the 
information indicated within the stored p ;rsonal data about the user when at least one user 
device has indicated the willingness to rect ive the information; and 

the selected user device when the selected user 



sending the vendor information 
device exists. 



to 



1 7. A method of controlling receipt of information, comprising the steps of: 

receiving, by a user device from a second party device, a request for at least some of 
the personal data of the user; 

attempting to reach an agreement w ith a second party, via the second party device, 
regarding use by the second party of any of ihe personal data of the user; and 

sending information to the user devicje only if the agreement is reached. 
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1 8. A system for providing per sonal data of a user with access rights being controlled 
by the user, the system comprising: 
a user device; 

a trusted party device, the user levice being arranged to communicate with the trusted 
party device; 

at least one data storage device including the personal data of the user; 

a rules enforcer included in the trusted party device to enforce rules by which the 
personal data of the user can be acces sed by a second party device, the rules having been 
agreed to by the user and a second part; r associated with the second party device, wherein: 

the at least one data storage device is associated with at least one of the user device 
and the trusted party device. 



19. The system of claim 18, fuither comprising a plurality of trusted party devices, 
each of the trusted party devices being configured to communicate with at least one other of 
the plurality of trusted party devices, whe rein: 

the at least one storage device is included in at least some of the plurality of trusted 
party devices and the personal data of the user is distributed among the at least one storage 
device of at least some of the plurality of trusted party devices. 



20. The system of claim 18, wherein the trusted party device further comprises an 
agreement facilitator to facilitate an agreement between the user and the trusted party. 

21. The system of claim 18; wherein the user device further comprises an agreement 
facilitator to facilitate an agreement between the user and the trusted party. 



22. The system of claim 18, wherein the at least one data storage device has recorded 
therein a service profile within a personal data repository, wherein the service profile includes 
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portions of the personal data of the user 
items within the service profile can be used by the second party. 



23. The system of claim 18, wherein 
history recorder to record a history of actions 



24. The system of claim 23., 
which the user, via the user device, can 
actions to be recorded. 
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and information regarding conditions under which 



the trusted party device further comprises a 
performed by the user device. 



whdrein the history recorder includes a level selector by 
select one of a plurality of levels of a type of the 



25. A system for providing personal data of a user with access rights being controlled 
by the user, the system comprising 
a user device; 

a second party device, the user device being arranged to communicate with the second 
party device; 

a data storage, associated with the u^er device, including the personal data of the user; 

and 

a rules enforcer included in the user! device to enforce rules by which portions of the 
personal data of the user can be accessed by the second party device, the rules having been 
agreed to by the user and a second party associated with the second party device, the rules 
including what items of the personal data arelreleasable to the second party and how the items 
of the personal data can be used by the second party. 



26. The system of claim 25, further Comprising a service profile stored within the 
data storage, the service profile including portions of the personal data of the user and 
information pertaining to an agreement describing how any of the stored information about 
the user can be used by the second party. 
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27. The system of claim 25, v 'herein the user device further comprises a history 
recorder to record a history of actions pe: formed by the user device. 



28. The system of claim 27, wh 
select one of a plurality of levels of a 



;rein the history recorder includes a level selector to 
of the actions to be recorded. 



type 



29. A device for providing perse nal data of a user with access rights being controlled 
by the user, the device comprising: 

a data storage device having recorded therein at least some of the personal data of the 

user; 

an agreement facilitator to faci itate an agreement between the user and a second 
party; and 

>y which items of the personal data of the user can be 
rules having been agreed to by the user and a second 
party associated with the second party c evice, the rules enforcer allowing access to only ones 
of the items, which according to the agr ;ement, can be used by the second party. 



a rules enforcer to enforce rules 
accessed by a second party device, the 



30. The device of claim 29, w ierein the data storage device has recorded therein a 
service profile within a personal data re pository, the service profile including portions of the 
personal data of the user and information regarding conditions under which items of the 
stored personal data of the user can be released to the second party. 



31. The device of claim 30, 
information regarding a date and a time 
is released to the second party. 



wherein the service profile is arranged to include 
ihat any of the stored personal information of the user 



32. The device of claim 30, wherein the service profile is arranged to include 
information pertaining to a contract that pescribes how any of the stored personal data of the 
user can be used by the second party. 
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33. The device of claim 29 
of actions performed by the user. 
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fun h 



34. The device of claim 33, 
which the user can select one of a pi 



whprein the history recorder includes a level selector by 
iuralfty of levels of a type of the actions to be recorded. 



provi( ing 



35. A mobile device for 
controlled by the user, the mobile device 

a rules enforcer to enforce the 
accessed by a second party device, the 
party associated with the second party d 

a data storage device having rec 

user; 

an agreement facilitator to 
party, wherein: 

the data storage device is arrang 
portions of the personal data of the usfcr 
items within the service profile can be 



ing personal data of a user with access rights being 
comprising: 

rules by which the personal data of the user can be 
•ules having been agreed to by the user and a second 
svice; 

)rded therein at least some of the personal data of the 



36. A machine-readable mediuiji 
in a device to perform the steps of: 

receiving an indication regarding 
personal data repository are releasable tp 

reaching an agreement, betweei 
second party, of any portions of the pen onal 

releasing any of the portions of fce 
to the second party according to the agreement 

i 



ier comprising a history recorder to record a history 



facilitate an agreement between the user and the second 



d to have recorded therein a service profile including 
and information regarding conditions under which 
by the second party. 



used 



having recorded thereon instructions for a processor 



which portions of personal data of a user stored in a 
a second party; 

the user and the second party, regarding use, by the 
data in the personal data repository; and 
stored personal data in the personal data repository 
;, wherein 
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within the personal data repository can be used by 



the agreement includes what items 
the second party, and 

only ones of the items which, acco ding to the agreement, can be used by the second 
party are released to the second party. 

37. The machine-readable mediui i of claim 36, further comprising instructions for 
storing of the personal data about the user in a distributed manner, the personal data being 
distributed and stored among a plurality of devices arranged to communicate with one 
another. 



38. The machine-readable mediujn 
allowing the user to perform at least one 
about the user. 



of claim 36, further comprising instructions for 
of adding, deleting or changing the personal data 



39. The machine-readable mediui ri of claim 36, further comprising instructions for 
allowing a defining of a service profile w thin a personal data repository, the service profile 
including portions of the personal data of t le user and information regarding conditions under 
which items of the stored personal data of the user can be released to the second party. 



40. The machine-readable medium 
information pertaining to the agreement 



of claim 39, wherein the service profile includes 
between the user and a second party. 



41. The machine-readable medium 
recording a history of actions by the user as 

42. The machine-readable medium 
defining, by the user, a level of a type of the 



of claim 36, further comprising instructions for 
;>art of the personal data of the user. 



of claim 41, further comprising instructions for 
iictions to be recorded. 
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43. A machine-readable medium having recorded thereon instructions for a processor 
in a device to perform the steps of: 

receiving, by a trusted party devic e, a request to send information; 

selecting a user device to receive the information based on a willingness to receive the 
information indicated within stored personal data about the user when at least one user device 
has indicated the willingness to receive t le information; and 

sending the vendor information to the selected user device when the selected user 
device exists. 

44. A machine-readable medium (having recorded thereon instructions for a processor 
in a device to perform the steps of: I 

receiving, by a user device from a second party device, a request for at least some of 
the personal data of the user; 1 



attempting to reach an agreement 
regarding use by the second party of any o 



with a second party, via the second party device, 
the personal data of the user; and 



sending vendor information to the v ser device only if the agreement is reached. 



45. A mobile device for providing 
controlled by the user, the mobile device co 



personal data of a user with access rights being 
mprising: 

a rules enforcer to enforce the rule s by which the personal data of the user can be 
accessed by a second party device, the rule; having been agreed to by the user and a second 
party associated with the second party device; 

a data storage device having recorded therein at least some of the personal data of the 



user; 



party; 



an agreement facilitator to facilitate 



I 



an agreement between the user and the second 



and 
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a history recorder to record a history of actions by the user via the user device, the 
history recorder including a level selector to select a level of the actions to be recorded, 
wherein: 1 

the data storage device is arranged to have recorded therein at least a portion of a 
service profile including information regarding what portions of the stored personal data of 



the user can be released to the second p 



irty and conditions under which the portions of the 



service profile can be released to the second party. 
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